Browse public community intelligence reports, source analysis, and threat research.
242 intel reports
A new macOS ClickFix campaign uses social engineering to trick users into running Terminal commands that silently mount DMGs and execute the Atomic macOS Stealer (AMOS).
Rapid Brigantine has pivoted to ClickFix lures on compromised WordPress sites to deploy the Lorem Ipsum Loader following a disruption to their previous malware-signing infrastructure.
The ROOTBOY actor is deploying Prinz Eugen, a technically deliberate Go-based ransomware that prioritizes fresh data and utilizes anti-forensics to evade detection.
The Mastra AI framework suffered a supply chain attack involving over 140 compromised npm packages that deliver a cross-platform infostealer via a typosquatted dependency.
Dropping Elephant is using a China-themed decoy document to deliver a heavily reworked, in-memory RAT via DLL side-loading and Donut shellcode.
Attacker sergey2016 compromised the @mastra npm organization to inject the easy-day-js typosquat dependency, delivering an obfuscated postinstall dropper.
The GLASSWORM threat actor is deploying trojanized Open VSX extensions using TinyGo-compiled WebAssembly loaders that leverage Solana blockchain memos for C2 infrastructure resolution.
EtherRAT uses the Ethereum blockchain for resilient C2 infrastructure while distributing via malicious MSI and PowerShell loaders.
Amos Stealer targets macOS environments to harvest browser credentials, Apple Keychains, and developer configuration files using sophisticated AppleScript and shell script execution.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
